Someone Else’s Problem

People are inherently selfish. It’s a self preservation thing. So, stop telling people the business is at risk. They already know that. They just do not think it is their problem.

Let’s go back a few years… Before I owned The Cyber Escape Room Co. ® before I worked in cyber… I worked in IT sales. Proper IT sales. Targets, pipeline, CRM, call lists, morning huddles, leaderboards, the usual theatre… And like every other sales team in the modern age, we’d all get the standard warnings from IT delivered with all the warmth of a parking fine. Do not click phishing emails. Do not open suspicious attachments. Do not hand over your credentials. Do not be the idiot who gets us breached.

And every single time, I had the same response.

Who gives a fuck?!

Not because I was reckless. Not because I was thick. Not because I wanted to be the weak link in some grand corporate morality tale. I just did a very fast piece of mental arithmetic that us in cyber almost never account for. If we got ransomwared, I could not log into anything. No systems meant no CRM. No CRM meant no pipeline. No pipeline meant no calls. No calls meant no work. No work meant, in the blunt and glorious language of a sales floor, a nice early finish.

It didn’t sound like catastrophe to me. It sounded like a break.

That is the bit we that we don’t say enough. I didn’t feel fear… I didn’t feel urgency. And I certainly didn’t feel some solemn connection to operational resilience or reputational damage or the sanctity of the corporate estate. I felt nothing, because the consequences, as they had been explained to me, were not mine. They belonged to the company, which in the mind of an ordinary employee is often an abstract, distant machine with a logo, an expense policy, and a tendency to send all-staff emails at 4.57pm.

If clicking a phishing email feels like a holiday, the training has already failed.

Years later, once I was properly inside the cyber world, that memory came back with a little flash of clarity. An “aha!” moment if you will. This is why so much cyber training does not land. Not because people are stupid. Not because they are lazy. But because the threat is not personally relevant.

Cyber teams are trained to describe risk in organisational language. Regulatory exposure. Operational disruption. Financial penalties. Data loss. Reputational harm. It all sounds very serious, and to be fair.. it is. But most employees don’t hear those phrases and picture some grand systems map lighting up in red. They hear them through the very practical filter of their own day. Does this affect my job this afternoon? Does this create hassle for me? Will this make me miss lunch, miss a deadline, look incompetent, annoy my manager, or land on my desk as extra work? Can I still get home on time?

That is not selfishness. That is how human beings work.

People anchor consequences around themselves. Around their team. Around the bit of reality they can actually feel with their hands. If the impact never reaches that level, the message stays abstract. And abstract messages are where behaviour change goes to die.

This is why fear-led cyber messaging so often lands with a thud. The industry has spent years effectively shouting, “if you click this, the business could collapse!!!” Which sounds dramatic in a board paper but, to a person in a frontline role, often translates to: sounds like a problem for somebody on a much higher salary. That “you could compromise confidential data” becomes “what data, exactly, and why would I care about it at 3.14pm on a Wednesday when I am already buried?” The “this could shut down operations” becomes “so no work then….?”

And there it is. The insultingly simple truth at the heart of the thing. The organisation’s risks are not automatically the employee’s risks. Until you bridge that gap, all the posters, slides, simulations and scare tactics in the world will keep bouncing off.

People do not change behaviour because you gave them a corporate consequence in a sans serif font.

People do not change behaviour because you gave them a corporate consequence in a sans serif font. They change because something becomes personally legible. Because they can see how it affects their workflow… their team… their customers.. their credibility,…their sense of competence.. their ability to get through the week without things going tits up. They care when the issue stops being a company problem and starts being a human one.

That is where a lot of cyber culture has gone wrong. It has insisted on talking in institutional language and then acted shocked when human beings respond like human beings. The lesson from my sales days was not that people are apathetic. It was that if clicking a phishing email feels like a holiday, then the training has already failed. And that is precisely why experiential learning changes the game.

Not because it is fun (although it very often it). Not because novelty alone has magical powers, because it does not. And not because adults secretly want to be trapped in a room with a padlock and a laminated clue sheet. It works because it does something traditional awareness training almost never manages. It creates personal relevance under pressure.

In an escape room or immersive cyber scenario, the problem stops floating above your head and lands squarely in your lap. You have to solve the puzzle. Your team is relying on you. A decision has consequences now, not in some hypothetical future incident report. You see the clues, misread the pattern, recover from the mistake, feel the pressure build, and understand instinctively that your behaviour changes the outcome.

The learning becomes embodied. Not decorative. Not theoretical. Real. That is exactly what our experiences do: put people inside a ransomware mystery or an insider-driven cyber crime investigation where decisions, clues, consequences and team pressure are impossible to ignore. They are designed around role-based attacks, social engineering, digital footprints, password habits and personal decision-making… all delivered through fast, theatrical, human-centred experiences rather than another slide deck begging for mercy.

That matters because memory is emotional before it is procedural. You can tell someone to report suspicious behaviour and hope the sentence lodges somewhere between annual leave policy and printer etiquette. Or you can let them feel the tension of being needed, the sting of getting it wrong, the satisfaction of seeing the pattern, and the immediate consequence of action. One of those tends to disappear before the coffee break. The other hangs around a good while longer.

The best cyber learning does not begin with what the business fears. It begins with what the person in front of you actually values. Their time. Their rhythm. Their confidence. Their team. Their customers. Their ability to do a decent job and not look daft AF doing it. Once you start there, everything sharpens. Reporting matters because it saves your team from a nightmare. Verification matters because it protects the customer relationship you have spent months building. Password hygiene matters because weak habits create very real mess for very real people… not because a policy document said so.

The point is not to make cyber softer. It is to make it more honest. Because the question that changes behaviour has never really been what could happen to the organisation. The question, the only one that bites, is much more intimate than that.

Why does this matter to me?

Until cyber can answer that with something more persuasive than because the company says so.. it will keep mistaking awareness for impact and attendance for belief. And people will keep nodding through phishing briefings while privately thinking what I once thought in sales, which was not panic, not duty, not dread, but a gloriously inconvenient little thought that should haunt the whole industry.

“This sounds like someone else’s problem.”